The present invention relates to an electronic engine controller having improved fire resistance. Such a controller is suited for use in controlling the speed of a gas turbine engine within an avionics environment.
It is known to provide full authority digital engine controllers to control the speed and thrust of gas turbine engines used in an aircraft. These controllers are generally very reliable. However, they tend to be mounted in close proximity to the engine and as such are located in a potentially hazardous position since engine malfunction, for example a fire, might effect the engine controller.
Although an engine malfunction may have occurred, and there may be fire within the engine nacelle, the prevailing flight conditions may be such that immediate engine shutdown is not acceptable. This may, for example, be because the pilot is at a critical stage in a takeoff or landing manoeuvre. The electronic engine controller may also become overheated due to less serious fault conditions, for example due to leaks from hot air ducts.
According to a first aspect of the present invention, there is provided an engine controller comprising a primary controller for controlling an engine and an auxiliary controller for controlling the engine, in which the primary controller is located within a first housing and the auxiliary controller is located within a second housing which is supported within the first housing, and in which the auxiliary controller is thermally insulated from the first housing.
The auxiliary controller need not be required to provide or reproduce the full functionality of the primary controller. Thus a smaller unit having reduced functionality could be provided. In a preferred embodiment the auxiliary controller provides protection for the engine, such that limits are provided to certain parameters of engine performance, such as turbine speed. Under such circumstances the auxiliary controller functions as an independent protection module.
It is thus possible to provide an electronic engine controller in which part of the control functionality, namely the auxiliary controller or the independent protection module, is provided in a thermally protected environment such that it has enhanced resistance and durability to xe2x80x9cover temperaturexe2x80x9d situations. Furthermore, by placing the housing for the auxiliary controller or the independent protection module within the housing of primary controller the auxiliary controller or the independent protection module can effectively benefit from two layers of protection against fire or mechanical damage.
Advantageously the second housing can be thinner and/or lighter then would be the case if the auxiliary controller or the independent protection module was located outside of the casing for the primary controller. Thus there is the potential for a weight saving to be obtained by virtue of placing the auxiliary controller or the independent protection module within the housing for the primary controller.
Preferably the auxiliary controller or the independent protection module and its associated housing sits within a recess formed in the first housing. The recess may be in the form of a closed channel. Thus the auxiliary controller or the independent protection module can be inserted into and/or removed from the housing of the primary controller without opening the first housing itself. Consequently the second housing is substantially, but not completely, enclosed by the primary controller and its associated first housing. However, the first housing provides a large and important degree of protection to the second housing in such an arrangement. In such an arrangement, the wall or face of the second housing which faces outwardly can be regarded as a front face of the auxiliary controller or the independent protection module and provides a route through which electrical connection can be made between the auxiliary controller or the independent protection module and the various aircraft systems with which it needs to interface. Advantageously the front face of the auxiliary controller or the independent protection module is itself protected by a fire wall and additionally insulation may be provided intermediate the fire wall and the front face. Alternatively the front face itself may be provided with a sufficient amount of insulation in order to ensure that heat leakage through that front face is sufficiently low to ensure that the internal temperature of the second housing remains within a predetermined value for a predetermined period of time. The predetermined value may be set at a guaranteed maximum working temperature of the electronics of the auxiliary controller or the independent protection module, and the predetermined period of time is chosen by the system designer, but may be in excess of several, for example 5, minutes.
Advantageously the second housing contains thermally insulating material in order to protect the auxiliary controller or the independent protection module in the event of fire. Additionally and/or alternatively, the first housing may contain insulating material in the vicinity of the second housing, for example on either an inner or outer surface of the wall defining the recess in which the second housing sits.
During operation, the electronics of the auxiliary controller or the independent protection module will dissipate heat. However the auxiliary controller or the independent protection module is itself located in a highly thermally insulated environment. It is therefore preferable that measures are taken to extract the heat generated within the second housing in order that the temperature therein remains within acceptable working levels. To this end, at least one heat dissipation device is provided to remove heat from the interior of the second housing. It will be appreciated that the interior of the second housing could be actively cooled, for example by pumping refrigerant/coolant into a heat exchange surface provided in the interior of the second housing. However, it is preferred that xe2x80x9cpassivexe2x80x9d forms of cooling are provided.
A preferred form of cooling is provided by heat pipes. Heat pipes are well known devices which rely on the latent heat of vaporisation of a liquid contained within the pipe to transfer heat from a xe2x80x9chot endxe2x80x9d of the pipe to a xe2x80x9ccool endxe2x80x9d of the pipe. In general, the liquid contained within the pipe evaporates at the hot end, and travels by virtue of vapour pressure to the cool end where it condenses. In order to continue operation of the heat pipe, the liquid then has to be returned to the hot end such that it can evaporate again. Advantageously, the transfer of liquid from the cool end to the hot end is performed solely by gravity. The avoidance of heat pipes having a wick contained therein (which constitutes the normal construction of a heat pipe) enables the heat transfer operation performed by the heat pipe to become effectively inhibited when the temperature at the notional xe2x80x9ccool endxe2x80x9d exceeds the temperature at the notional xe2x80x9chot endxe2x80x9d. Thus, in the present arrangement where the hot end is located inside of the second housing and the cool end is located outside of the second housing, then heat transfer along the heat pipe is significantly reduced once the temperature outside of the second housing exceeds the temperature inside of the second housing. The device functions like a thermal diode, only allowing substantial heat transfer in one direction.
Preferably the primary controller itself comprises first and second channels each of which is capable of fully controlling the functions of the associated gas turbine engine. Thus, in the event of failure of one channel, the other channel may take over.
Preferably the independent protection module acts, in the event of failure of the primary controller, to limit fuel flow to the engine when the aircraft is airborne or to shut off fuel when the aircraft is on the ground, possibly subject to other conditions such as speed being below a threshold, being satisfied. The independent protection module advantageously also comprises two channels with either channel being able to perform the control/protection tasks necessary to ensure operation of the engine.
Advantageously, each primary control channel has an independent power supply. Advantageously, each independent protection module or auxiliary channel has an independent power supply. Thus failure of any single power supply only effects one channel in either the primary controller, the auxiliary controller, or the independent protection module.
In order to enhance reliability, the independent protection module or auxiliary controller is effectively electrically isolated from the primary controller. That is to say that the independent protection module receives engine data, such as generator speed, engine spool speeds, turbine temperature and so on via data connections which are independent from those used to provide data to the primary controller. Indeed, each channel of the independent protection module and each channel of the primary controller advantageously receives this data via its own dedicated interfaces and connections. Similarly the primary controller and the independent protection module also need to receive certain airframe derived data in order to formulate a correct engine response. Such data includes pilot throttle position and optionally data regarding flight surface positions and undercarriage loading in order that the controllers or independent protection module can determine whether the aircraft is still on the ground or whether it is in a flight mode where the high lift surfaces are deployed, and consequently the aircraft can be expected to either be in the final stages of approach to the runway or in the early stages of takeoff from a runway.
Advantageously electrical connections to at least the independent protection module or the auxiliary controller are made using fire resistant male and female connectors, and connections between the pins of these connectors and the various cables connected to them are made by crimping (rather than soldering) such that the connections are heat resistant, and in particular that they cannot fail due to the melting of solder.
The independent protection module may monitor the engine performance at all times and be arranged to provide protection against the occurrence of engine overspeed or overthrust conditions. Thus the independent protection module controller may only need a limited subset of engine and other data.
According to a second aspect of the present invention, there is provided an independent protection module provided within an independent protection module casing for engagement within a co-operating recess of a structure arranged to hold the independent protection module, wherein one of the independent protection module""s housing and the co-operating recess is thermally insulated, and cooling means are provided to remove heat from the interior of the independent protection module.